IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  How to split mac otp ?

    Posted 10/19/20 10:30 AM
    Hi All,

    I need help, How to split mac(8-digit) OTP into 2 parts. and send 1 part on mobile(SMS) and another part on email.

    Is this possible in ISAM?

    ------------------------------
    Mukesh
    ------------------------------


  • 2.  RE: How to split mac otp ?

    Posted 10/19/20 10:44 AM
    Mukesh,

    This is not supported by the out-of-box authentication mechanisms.  The e-mail and SMS OTP mechanisms are both self-contained and must complete individually before the next one is called.

    In order to implement what you are requesting here you would need to build something bespoke.  I think you would be able to use the built-in "send e-mail" mechanism to send the e-mail part of the OTP but you'd have to integrate manually with a 3rd party SMS gateway (using HTTP helper) to send the SMS part.  So your policy would looks something like this:

    1) Custom JavaScript mechanism to generate 2 part OTP and store parts in context.  Also read e-mail address and mobile number from credential or LDAP
    2) Use built in e-mail sending mechanism to send part 1 of OTP via e-mail to user.  Alternatively use 3rd party e-mail sending service via REST/HTTP
    3) Use custom JavaScript mechanism to send part 2 of OTP via 3rd party SMS service (using REST/HTTP)
    4) Present challenge page to user asking for final OTP.  Validate against values stored in context and allow access if correct.

    This custom effort is not super-complex but it's not trivial either.  I believe this is quite an unusual 2FA approach so perhaps worth validating with the business owner that there isn't some other suitable risk mitigation that could be used before going further down this road.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------